[QUESTION] (How) Is this maintained?

[karfau]

What / Why

• the last commit to the default branch was from end of August 2019
• there are 6 open PRs for updating dependencies (also related to security issues, see [QUESTION] Vulnerabilities in npx 10.2.0 #29) and all but one of them have been created beginning of November 2019
• the last release on npm was in April 2018

Can something be done to support keeping this package up to date?
E.g. by adding some contributors?

Who

• @npm/npx (not sure there is such a team)
• @zkat (hoping she has some information to share)

References

• Is this project dead? zkat/npx#223

PS: I'm willing to contribute.
PPS: I'm also very interested in some of the features people asked for, but I think keeping this package up to date is more important.

[yafp]

(How) Is this maintained?

seems like the answer to your question is simply "(not) no " :(

[karfau]

🎉 there is some recent activity:

• commit 3192e0f, fixing (and breaking) some URLs, followed by a release
• all the PRs created by dependabot have been closed

Let's hope this is a start into a new row of repo activity.

[rivy]

🤞
... But, after the repository was "transferred" from @zkat (read: @fharper and @zkat were abruptly laid off), back in early/mid-2019, it looks like there has been a complete lack of community interaction. There's barely been a couple of under-the-radar commits by @isaacs ("the inventor of npm").

Maybe yarn and yarn-based solution would be a better way to go?

I just saw ynpx. 🤞

[karfau]

@isaacs, @darcyclarke (as the only people I'm aware of that have write access to this repo) is there any chance you can shed some light on this question now or at some foreseeable point in time?

[karfau]

@ anybody else:
Trying to maintain a fork is not an small task and could lead nowhere if it is not adopted. It's surely only making sense when it is started with multiple people working on (the same fork) together in a concentrated manner, with clearly defined goals/scope/road map.

I would love to know how many people are willing and able (expertise and time to contribute) to attempt this. Please only add 🚀 reaction to this comment in that case.

[isaacs]

It's on my todo list to revisit this module this once npm v7 is further along. It has a number of issues (including, of course, that the bin uses npm v5 to download and packages, the breakdown of the bin and the lib is unnecessarily convoluted, lack of test coverage, and some other issues).

A review of the codebase has led me to believe that the most straightforward way to address the majority of the issues is with a thorough refactor. In the meantime, it's mostly working and coasting along. I don't expect the API to change with the rework for npm v7. This will probably take place some time in Q2 of 2020.

If anyone wants to maintain a fork, or move to ynpx, or anything else to get your needs met, I fully support your initiative. More OSS creativity is almost always a good thing, imo. Just updating here with what to expect and when.

[jmackay-io]

In the meantime, it's mostly working and coasting along. I don't expect the API to change with the rework for npm v7. This will probably take place some time in Q2 of 2020.

Windows users haven't been able to pass command-line args to npx for over 7 months now (#5). This isn't a request for new features - npx broke thousands of build pipelines.

Who releases a broken build and then walks away for a year?

[karfau]

@isaacs If there is any way to contribute to whatever plan you have, please let us know here.
I think this tool is really worth being supported by a large community.

[KilianKilmister]

General callout for people potentially interested in collaborating on an npx alternative in light of its unmaintained status.
A project proposal can be found here.

My sincerest apologies on "advertising" an alternative project on this repository, but in the current light of things, this is where people that might have interest in colablaborating on an alternative are likely to flock. And unless this project is officially put on hold/deprecated, I won't make a habit of it.

[karfau]

There is finally some information on the topic out in the public:
https://blog.npmjs.org/post/626173315965468672/npm-v7-series-beta-release-and-semver-major (Check the "npx" section).

No idea how this impacts this repository, since there has been some recent activity in it.
At least the recent changes look like this repo will be abandoned further in the near future:
https://github.com/npm/cli/commits/v7.0.0-beta.4/bin/npx-cli.js

[KilianKilmister]

Awesome stuff. I really like the look npm-v7 and the i always wondered why npx functionality wasn't directly integrated into npm.

This really saves me a bunch of work as this provides me with a modern and well mentained core

as for this repo, i assume it will be archived. the blog states:

The npx binary was rewritten in npm v7, and the standalone npx package deprecated when v7.0.0 hits GA.

the first few lines of npx-cli.js also directly point to npm

#!/usr/bin/env node

const cli = require('../lib/cli.js')

// run the resulting command as `npm exec ...args`
process.argv[1] = require.resolve('./npm-cli.js')
process.argv.splice(2, 0, 'exec')

I checked out the code and everything is now handled in exec.js

Well, i guess I'll check out the beta

[isaacs]

Yep, that's the plan. npx will be effectively an alias to npm exec (with some slight tweaks to continue handling the -p argument to mean --package rather than --parseable, and add a -- after the first position argument, so we maintain backwards compatibility with npx's argv semantics).

Once v7.0.0 ships to GA, we'll deprecate this module and repo.

[leafac]

$ npm --version
7.4.0

Is this repository still the right place in which to open issues about npx?

[ljharb]

no, npm/cli is.

[leafac]

May I send a PR updating the README to mention that?

[karfau]

May I send a PR updating the README to mention that?

@leafac Maybe/hopefully that could be the thing that allows any maintainer to make this fact more transparent. (And possibly archive this repo?) 🙏

[ljharb]

It’s still needed as a separate package. It’s just that in npm 7, the npx binary is not this package, but is a wrapper around npm exec. You can still install this package separately, or install it in a version of npm < 7.

[karfau]

Just checked, and there have actually been new commits and tags to this repo in June, which I was not aware of. So, since there seems to exist some kind of positive answer to my initial question. The idea for the PR to highlight the version situation is a really good idea.

And sorry for my sarcasm and ignorance 🤷‍♂️

[isaacs]

Technically, npx as a standalone package hasn't been relevant for about 3.5 years, since npm/cli@fb040bee0 shipped as part of npm cli v5.2.0, bundling a npx binary. The only value of having it is for npm versions less than 5.2.0.

AFAIK, we do intend to deprecate this repository, the npx standalone package, and libnpx, once npm v7 moves to GA "latest" status. The correct place to post issues with npx in npm v6 is indeed on https://github.com/npm/cli